Quantum machine learning (QML) continues to be an area of tremendous interest from research and industry. While QML models have been shown to be vulnerable to adversarial attacks much in the same manner as classical machine learning models, it is still largely unknown how to compare adversarial attacks on quantum versus classical models. In this paper, we show how to systematically investigate the similarities and differences in adversarial robustness of classical and quantum models using transfer attacks, perturbation patterns and Lipschitz bounds. More specifically, we focus on classification tasks on a handcrafted dataset that allows quantitative analysis for feature attribution. This enables us to get insight, both theoretically and experimentally, on the robustness of classification networks. We start by comparing typical QML model architectures such as amplitude and re-upload encoding circuits with variational parameters to a classical ConvNet architecture. Next, we introduce a classical approximation of QML circuits (originally obtained with Random Fourier Features sampling but adapted in this work to fit a trainable encoding) and evaluate this model, denoted Fourier network, in comparison to other architectures. Our findings show that this Fourier network can be seen as a “middle ground” on the quantum-classical boundary. While adversarial attacks successfully transfer across this boundary in both directions, we also show that regularization helps quantum networks to be more robust, which has direct impact on Lipschitz bounds and transfer attacks.
Quantum machine learning (QML) continues to be an area of tremendous interest from research and industry. While QML models have been shown to be vulnerable to adversarial attacks much in the same manner as classical machine learning models, it is still largely unknown how to compare adversarial attacks on quantum versus classical models. In this paper, we show how to systematically investigate the similarities and differences in adversarial robustness of classical and quantum models using transfer attacks, perturbation patterns and Lipschitz bounds. More specifically, we focus on classification tasks on a handcrafted dataset that allows quantitative analysis for feature attribution. This enables us to get insight, both theoretically and experimentally, on the robustness of classification networks. We start by comparing typical QML model architectures such as amplitude and re-upload encoding circuits with variational parameters to a classical ConvNet architecture. Next, we introduce a classical approximation of QML circuits (originally obtained with Random Fourier Features sampling but adapted in this work to fit a trainable encoding) and evaluate this model, denoted Fourier network, in comparison to other architectures. Our findings show that this Fourier network can be seen as a “middle ground” on the quantum-classical boundary. While adversarial attacks successfully transfer across this boundary in both directions, we also show that regularization helps quantum networks to be more robust, which has direct impact on Lipschitz bounds and transfer attacks.
Quantum Machine Learning (QML) fuses quantum computing with machine learning to address complex tasks with potential speedups over classical methods. While QML models such as variational quantum classifiers (QVC), quantum multilayer perceptron(QMLP) models and quantum convolutional neural networks (QCNN) have demonstrated promise in applications like image recognition and malware classification, they remain vulnerable to adversarial threats. Inspired by the vulnerabilities in classical ML, this work systematically investigates how attacks-ranging from training-time poisoning and inferencetime evasion (e.g., quantum versions of FGSM and PGD) to deployment-time trigger attacks-manifest in quantum circuits. We explore how classical adversarial strategies adapt to quantum models through parameterized encodings, hybrid architectures, and probabilistic outputs. The poster evaluates different quantum classifiers under adversarial settings, comparing their robustness, trainability, and resilience to perturbations. Defense mechanisms such as randomized encoding, engineered noise channels, and quantum adversarial training are analyzed in relation to specific threat types. In addition, we assess how quantum models behave differently than classical counterparts under attack, and how quantum-specific design constraints can either exacerbate or mitigate these effects. Our ultimate goal is to define and construct robust QML systems that are both theoretically sound and practically secure. By synthesizing results across multiple QML architectures and threat models, this work provides actionable insight into the development of resilient quantum classifiers, paving the way toward trustworthy and scalable quantum machine learning.
Quantum Machine Learning (QML) has emerged as a promising paradigm that combines the power of quantum computing with the adaptability of machine learning. QML models have demonstrated potential advantages in solving complex problems across domains such as optimization, pattern recognition, and generative modeling. While much attention has been devoted to exploring their computational benefits and capabilities, the security of QML models and their robustness to adversarial attacks remains an underexplored area in the literature. Understanding adversarial vulnerabilities is critical for assessing the reliability of QML systems, especially as they transition from theoretical constructs to practical applications. In this work, we present an empirical study on the adversarial robustness of QML models. We systematically evaluate the susceptibility of quantum models to adversarial attacks, comparing them with classical counterparts across different settings. Additionally, we examine cross-paradigm attack transferability by testing classical attacks on quantum models and vice versa. Our results indicate that QML models exhibit higher vulnerability in white-box settings and stronger attack transferability than classical ML models. Furthermore, while adversarial training can provide some robustness, its effectiveness remains limited. Our findings contribute to a better understanding of QML security and provide insights into the challenges of building robust QML systems.
State-of-the-art classical neural networks are observed to be vulnerable to small crafted adversarial perturbations. A more severe vulnerability has been noted for quantum machine learning (QML) models classifying Haar-random pure states. This stems from the concentration of measure phenomenon, a property of the metric space when sampled probabilistically, and is independent of the classification protocol. To provide insights into the adversarial robustness of a quantum classifier on real-world classification tasks, we focus on the adversarial robustness in classifying a subset of encoded states that are smoothly generated from a Gaussian latent space. We show that the vulnerability of this task is considerably weaker than that of classifying Haar-random pure states. In particular, we find only mildly polynomially decreasing robustness in the number of qubits, in contrast to the exponentially decreasing robustness when classifying Haar-random pure states and suggesting that QML models can be useful for real-world classification tasks.
In this work, we investigate the performance of hybrid quantum-classical convolutional neural networks (QCNNs) in medical image classification under the presence of adversarial attacks. Adversarial attacks pose a significant threat to image classification models, since they introduce subtle perturbations to input images, leading to incorrect predictions. Specifically, in this work, 10 QCNNs with their corresponding classic Convolutional Neural Networks (CNNs) counterparts are comparatively examined for their robustness, on two different medical image datasets using transfer learning, under two different adversarial attacks. In a subsequent step, the implementation of training models from scratch is also evaluated. With transfer learning on the X-ray dataset, CNN and QCNN models achieve high and comparable performance across most backbones. On the histopathological dataset, CNNs and QCNNs often generalize worse compared to the X-ray dataset, indicating head overfitting under domain shift. The adversarial evaluation results highlight that most models' robustness comes from the backbone rather than the head. QCNN models perform comparably to CNNs under attack and show improvements when trained from scratch. Overall, the results indicate that integrating quantum circuit mechanisms into classical CNN architectures can enhance the robustness of models in medical imaging tasks, representing a promising domain that warrants further investigation.
Quantum machine learning (QML) is emerging as a promising paradigm at the intersection of quantum computing and artificial intelligence, yet its security under adversarial conditions remains insufficiently understood. This scoping review aims to systematically map empirical research on adversarial robustness in QML and to identify dominant threat models, defense strategies, evaluation approaches, practical constraints, and future research directions. Following PRISMA-ScR guidelines, four major databases were searched, resulting in 53 eligible empirical studies published between 2020 and 2026. The findings show that most research concentrates on input-level evasion attacks, particularly adversarial examples, and primarily evaluates robustness in classification-oriented models such as variational quantum circuits and quantum neural networks. Defense strategies are largely adapted from classical adversarial training and noise-based mitigation, with limited deployment on real quantum hardware. Robustness assessment is predominantly empirical, relying on accuracy degradation and attack success rate, while formal certification methods remain less common. The literature also highlights substantial constraints related to hardware limitations, NISQ noise, computational cost, and dataset scale. Overall, the evidence indicates that adversarial robustness research in QML is expanding but remains methodologically concentrated, underscoring the need for standardized benchmarking, scalable defenses, and hardware-validated robustness evaluation frameworks.
Machine learning models and their applications, such as autonomous driving systems, are becoming increasingly common and are essential components of human daily life. However, due to their sensitivity to perturbed noise, these models are easily susceptible to adversarial attacks. Not only are classical machine learning models affected, but quantum machine learning (QML) models have also been proven to be vulnerable to adversarial attacks, which degrade their performance. To defend against these types of attacks, several classical methods have been proposed. Among these, a prominent approach uses various types of pseudo-noise during training to enhance the model's robustness against real-world attacks. One of the recently emerging solutions is to leverage the unique properties of quantum circuits to create quantum-based pseudo-noise similar to real perturbed noise to counter adversarial attacks. This paper proposes a solution that utilizes random quantum circuits (RQCs) as adversarial data to help QML models overcome these adversarial attacks. The results reported in this paper show that the data generated by RQC actually provides a similar effect to models trained with adversarial data on high-feature datasets. This quantum-based pseudo-noise resulted in a significant reduction in the attack rate in the CIFAR-10 data set, from \textbf{89. 8\%} to \textbf{68.45\%}. For the CINIC-10 dataset, the successful attack rate decreased from \textbf{94.23\%} to \textbf{78.68\%}. This research opens up avenues for applying unique quantum properties, such as superposition, entanglement, and even decoherence, to enhance the quality of machine learning models.